PT-2021-7220 · Microsoft · Office 365

Published 2021-10-21 · Updated 2022-07-25 · CVE-2022-2076

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Office 365 (affected versions not specified)

Description The issue is related to an incorrect session expiration in Microsoft Office 365, potentially allowing a remote attacker to gain unauthorized access to protected information. The problem arises from session cookies that might be used by two clients simultaneously. The attack can be initiated remotely. There are doubts about the real-world consequences of this issue.

Recommendations To mitigate the issue, consider changing the configuration settings. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BDU:2022-03882

CVE-2022-2076

Affected Products

Office 365

References · 8

• 🔥 https://github.com/sixgroup-security/Advisories/tree/main/20211209_Missing-Session-Hijacking-Protection-in-Microsoft-O365 · Exploit
• https://bdu.fstec.ru/vul/2022-03882 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-2076 · Security Note
• https://t.me/cvenotify/31563 · Telegram Post
• https://vuldb.com/?id.192028 · Note
• https://mandiant.com/resources/russian-targeting-gov-business · Note
• https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation · Note
• https://mandiant.com/sites/default/files/2021-11/wp-m-unc2452-000343.pdf · Note